Deploy and Manage AD DS

You plan to deploy a new domain controller as an Azure Virtual Machine (VM) to provide authentication for cloud workloads. Which THREE actions should you take to ensure the stability and supportability of the domain controller? (Each correct answer presents part of the solution.)

You are adding a new Windows Server 2022 domain controller to an existing forest that currently has a functional level of Windows Server 2012 R2. What is the maximum functional level you can set for the new domain controller?

Refer to the exhibit. You are troubleshooting a replication issue between the Head Office (Site-HQ) and a Branch Office (Site-Branch-A). Based on the output, what is the most likely cause of the failure?

Refer to the exhibit. You are troubleshooting an issue where several users are unable to change their passwords, and the help desk is seeing inconsistent results when resetting them. Based on the output provided, which domain controller should you investigate first for potential failures or connectivity issues?

You are the administrator of a large multi-domain forest. You have a branch office with a slow WAN link that contains only one domain controller. Users in this office complain that they cannot log on when the WAN link is down, even though they belong to Universal Groups. How should you resolve this issue while minimizing WAN traffic?

You accidentally delete an Organizational Unit (OU) containing 500 users. You need to recover the OU and its contents with all attributes, including group memberships, intact. What is the most efficient way to achieve this?

You need to create a service account for a custom application that runs on a single Windows server. The account must support automatic password management and must not require manual SPN registration. Which type of account should you use?

An administrator accidentally deleted an Organizational Unit (OU) containing several hundred user accounts. You need to recover the OU and its contents with the least amount of administrative effort and without taking any domain controllers offline. What should you use?

You plan to implement Group Managed Service Accounts (gMSAs) to improve the security of several web services. Which TWO prerequisites must be met before you can create and use gMSAs in your Active Directory environment?

Refer to the exhibit. You are reviewing the output of a command used to check the health of your domain controllers. Based on the first line of the output, which specific role or feature is currently enabled on this domain controller?

You are managing an Active Directory domain that includes several Fine-Grained Password Policies (FGPP). A user is a member of two global groups: 'Sales-Group' and 'Marketing-Group'. 'Sales-Group' is assigned a Password Settings Object (PSO) with a precedence of 50. 'Marketing-Group' is assigned a PSO with a precedence of 20. Which policy will be applied to the user?

You are preparing to raise the forest functional level of an existing Active Directory environment to Windows Server 2016. Which TWO requirements must be met before you can successfully perform this action? (Each correct answer presents part of the solution.)

You manage two Active Directory forests named fabrikam.com and contoso.com. A two-way forest trust exists between them. You want to allow users from fabrikam.com to access a specific file server in contoso.com, but you must ensure they cannot authenticate to any other resources in the contoso.com forest by default. Which authentication setting should you configure on the trust?

Your company is merging with another firm. You need to allow users in the 'contoso.com' forest to access resources in the 'fabrikam.com' forest. The solution must ensure that users from Fabrikam cannot access any resources in Contoso unless specifically granted permission on each individual resource. What should you configure?

Your organization has two primary data centers in Seattle and New York, connected by a high-latency WAN link. You need to ensure that Active Directory replication occurs only during non-business hours to preserve bandwidth for critical applications. Which Active Directory object should you modify to control the timing of data synchronization between these locations?

You are deploying a Read-Only Domain Controller (RODC) in a branch office with low physical security. You need to ensure that the branch manager, who is not a member of Domain Admins, can log on to the RODC even if the WAN link to the main office is down. What must you configure?

Your company, Contoso, Ltd., has a branch office with ten employees. The office has poor physical security, and you are concerned about the risks of a local domain controller being stolen. You need to deploy a domain controller to this site that minimizes the security risk of credential theft for the rest of the domain. Which solution should you implement?

You have three Active Directory sites: SiteA, SiteB, and SiteC. SiteA is connected to SiteB with a cost of 50. SiteB is connected to SiteC with a cost of 50. There is no direct link between SiteA and SiteC. If 'Bridge all site links' is enabled, what is the effective replication cost between SiteA and SiteC?

You want to allow a specific help desk user to reset passwords for all users in a specific Organizational Unit (OU), but you do not want to grant them any other administrative rights. What is the most appropriate tool to use?

You need to automate the deployment of a new domain controller in an existing domain using PowerShell. Which cmdlet should you use to install the Active Directory Domain Services role and promote the server after the binaries are present?

Refer to the exhibit. You are running dcdiag to investigate synchronization issues between two domain controllers. Based on the error code 1256 and the output provided, which action is most likely to resolve the underlying problem?

You need to inspect the state of Active Directory objects as they existed three days ago to troubleshoot an issue. You have a system state backup from that time. Which TWO tools must you use to view the contents of the database from the backup without performing a full restore? (Each correct answer presents part of the solution.)

The domain controller holding the RID Master FSMO role in your domain has suffered a catastrophic hardware failure and will be offline for several weeks. You notice that administrators can no longer create new user objects. What should you do to resolve this issue immediately?

You need to apply a stricter password policy to a group of executives than the one defined in the Default Domain Policy. You want to achieve this without creating a separate domain. Which feature should you implement?